Spain ENS mp.info.1: Personal data requirements from the controller and DPO

What does mp.info.1 require?

Where the system processes personal data, the security officer gathers the data protection requirements set by the controller or processor with the DPO's advice, based on nature, scope, context, purposes and risks under GDPR Articles 24 and 32 and any DPIA, and implements them.